Outlook.com Has Started Bouncing Mail From Domains With No DMARC Record. Layered Email Authentication Beats Any Single Fix
Since about November 5, email admins report that Outlook.com, Hotmail, Live and MSN addresses are rejecting some messages from domains with no DMARC record, even when SPF and DKIM pass. Microsoft has not announced the change. One DNS record stops the bounce, but it should be the start of a layered plan.
Here Is How Layered Email Authentication Keeps Your Messages Delivered
If customers with Hotmail or Outlook.com addresses suddenly say your invoices or quotes never arrived, check your bounce messages. Since about November 5, email administrators report that Microsoft’s consumer mail service is turning away some messages from domains that have no DMARC record, even small senders whose other authentication checks pass.
Deliverability expert Al Iverson documented and reproduced the behavior in his Spam Resource post on Microsoft rejecting mail that lacks DMARC, and email security company MailRoute published its own guide to the new rejection. The answers below are drawn from both.
What exactly is happening?
Mail sent to outlook.com, hotmail.com, live.com and msn.com addresses is being rejected with this error: 550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519). MailRoute says Microsoft’s consumer mail servers started returning it on November 5. Iverson reports that admins on the Mailop mailing list were discussing it by the night of November 6.
Did Microsoft announce this?
Not as of the reports. MailRoute said that as of November 6 there was no postmaster notice, blog post or service-health entry. Microsoft’s published rule, in force since May 2025, requires SPF, DKIM and DMARC only for domains sending more than 5,000 messages a day, and that rule bounces with a different code, 550 5.7.515. This new rejection reaches low-volume senders too.
Is every message blocked?
Not necessarily. Some admins describe it as sporadic, and MailRoute says only part of the mail from a domain without DMARC is turned away. So a message that got through yesterday does not prove your domain is fine. When Iverson removed DMARC from several of his own non-bulk domains on November 7, mail to outlook.com was rejected.
Are business Microsoft 365 mailboxes affected?
The reports so far point only at Microsoft’s consumer domains. In Iverson’s test, the same message sent to a Microsoft 365-hosted corporate domain was accepted.
What is the quick fix?
Publish a DMARC record. At your DNS host, add a TXT record named _dmarc with a value such as v=DMARC1; p=none. A few cautions from MailRoute: a domain should have only one DMARC record, many DNS hosts add your domain name automatically so enter just _dmarc, and DMARC passes only if SPF or DKIM passes for the same domain shown in the From address. If neither aligns, the record alone will not help.
I don’t run a mail server. What do I do?
Iverson’s advice: contact whoever sends mail on your behalf, such as your email provider, CRM or marketing platform, and ask them to help you set it up.
Why a single DNS record is not the whole answer
A p=none record clears this bounce, but it tells receivers to take no action when someone spoofs your domain. Real protection comes from stacking layers:
- Know every sender. List every service that sends as your domain: your main mailbox platform, billing, CRM, help desk, website forms, scanners and copiers.
- Authenticate each one. Make sure each sender is covered by SPF and signs with DKIM under your domain. Major platforms such as Microsoft 365 and Google Workspace both offer DKIM signing, but it often has to be switched on.
- Turn on reporting. Add an aggregate-report address (
rua=) so you can see who is sending as you. - Tighten over time. Once reports show only legitimate senders, move the policy from
nonetoquarantineand then torejectto shut out impersonators. - Cover forgotten domains. Old brand names and domains you own but never send from should publish a strict policy so they cannot be abused.
- Protect the mailbox itself. Phishing-resistant multi-factor sign-in, inbound filtering and staff training stop the attacks that authentication alone cannot.
What this means for your company
For many small businesses, email is the billing system, the sales pipeline and the customer-service desk. An unannounced filter change at one large mailbox provider can quietly cut off a slice of your customers, and the fix is usually a five-minute DNS edit that nobody got around to. Check today whether each domain you send from has a DMARC record, watch for bounces that mention AS9031519, and then treat the record as the first layer of a plan rather than the last. The same layers that keep your mail delivered also make it much harder for criminals to send convincing fake invoices in your name.
Want a vendor-neutral check of SPF, DKIM and DMARC across every domain and service that sends email for your business? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
